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Abstract — In the context of wireless sensor networks, the 
pairwise key distribution scheme of Chan et al. has several 
advantages over other key distribution schemes including 
the original scheme of Eschenauer and Gligor. However, 
this offline pairwise key distribution mechanism requires 
that the network size be set in advance, and involves all 
sensor nodes simultaneously. Here, we address this issue 
by describing an implementation of the pairwise scheme 
that supports the gradual deployment of sensor nodes in 
several consecutive phases. We discuss the key ring size 
needed to maintain the secure connectivity throughout all 
the deployment phases. In particular we show that the 
number of keys at each sensor node can be taken to be 
O(logn) in order to achieve secure connectivity (with high 
probability). 

Keywords: Wireless sensor networks, Security, Key predis- 
tribution, Random key graphs, Connectivity. 

I. Introduction 

Wireless sensor networks (WSNs) are distributed collections 
of sensors with limited capabilities for computations and wire- 
less communications. Such networks will likely be deployed 
in hostile environments where cryptographic protection will 
be needed to enable secure communications, sensor-capture 
detection, key revocation and sensor disabling. However, tra- 
ditional key exchange and distribution protocols based on 
trusting third parties have been found inadequate for large- 
scale WSNs, e.g., see (6), iflOl . Ifl2ll for discussions of some 
of the challenges. 

Random key predistribution schemes were recently pro- 
posed to address some of these challenges. The idea of ran- 
domly assigning secure keys to sensor nodes prior to network 
deployment was first proposed by Eschenauer and Gligor ||6). 
The modeling and performance of the EG scheme, as we refer 
to it hereafter, has been extensively investigated 0], JU, |6), 
ED, 03, QH, 03), with most of the focus being on the full 
visibility case where nodes are all within communication range 
of each other. Under full visibility, the EG scheme induces so- 
called random key graphs lfl3l (also known in the literature 
as uniform random intersection graphs |]T|). Conditions on the 
graph parameters to ensure the absence of isolated nodes have 
been obtained independently in 01 > lfl3l while the papers 



Q], 0, OH, OH, 03 are concerned with zero-one laws 
for connectivity. Although the assumption of full visibility 
does away with the wireless nature of the communication 
infrastructure supporting WSNs, in return this simplification 
makes it possible to focus on how randomizing the key 
selections affects the establishment of a secure network; the 
connectivity results for the underlying random key graph then 
provide helpful (though optimistic) guidelines to dimension 
the EG scheme. 

The work of Eschenauer and Gligor has spurred the de- 
velopment of other key distribution schemes which perform 
better than the EG scheme in some aspects, e.g., J3, A3, IflOl . 
02). Although these schemes somewhat improve resiliency, 
they fail to provide perfect resiliency against node capture 
attacks. More importantly, they do not provide a node with 
the ability to authenticate the identity of the neighbors with 
which it communicates. This is a major drawback in terms of 
network security since node-to-node authentication may help 
detect node misbehavior, and provides resistance against node 
replication attacks J3- 

To address this issue Chan et al. J3 have proposed the 
following random pairwise key predistribution scheme: Before 
deployment, each of the n sensor nodes is paired (offline) with 
K distinct nodes which are randomly selected amongst all 
other Ti—l nodes. For each such pairing, a unique pairwise 
key is generated and stored in the memory modules of each of 
the paired sensors along with the id of the other node. A secure 
link can then be established between two communicating 
nodes if at least one of them has been assigned to the other, 
i.e., if they have at least one key in common. See Section Gj] 
for implementation details. 

This scheme has the following advantages over the EG 
scheme (and others): (i) Even if some nodes are captured, 
the secrecy of the remaining nodes is perfectly preserved; and 
(ii) Unlike earlier schemes, this scheme enables both node- 
to-node authentication and quorum-based revocation without 
involving a base station. Given these advantages, we found 
it of interest to model the pairwise scheme of Chan et al. 
and to assess its performance. In |[T6l we began a formal 
investigation along these lines. Let H(n; K) denote the random 
graph on the vertex set {1, . . . , n} where distinct nodes i and 
j are adjacent if they have a pairwise key in common; as in 
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earlier work on the EG scheme this corresponds to modeling 
the random pairwise distribution scheme under full visibility. 
In lfl6l we showed that the probability of H(n; K) being 
connected approaches 1 (resp. 0) as n grows large if K > 2 
(resp. if K = 1), i.e., H(n; K) is asymptotically almost surely 
(a.a.s.) connected whenever K > 2. 

In the present paper, we continue our study of connectivity 
properties but from a different perspective: We note that in 
many applications, the sensor nodes are expected to be de- 
ployed gradually over time. Yet, the pairwise key distribution 
is an offline pairing mechanism which simultaneously involves 
all n nodes. Thus, once the network size n is set, there is no 
way to add more nodes to the network and still recursively 
expand the pairwise distribution scheme (as is possible for 
the EG scheme). However, as explained in Section III-BI the 
gradual deployment of a large number of sensor nodes is 
nevertheless feasible from a practical viewpoint. In that context 
we are interested in understanding how the parameter K needs 
to scale with n large in order to ensure that connectivity 
is maintained a.a.s. throughout gradual deployment. We also 
discuss the number of keys needed in the memory module of 
each sensor to achieve secure connectivity at every step of 
the gradual deployment. Since sensor nodes are expected to 
have very limited memory, it is crucial for a key distribution 
scheme to have low memory requirements 0. 

The key contributions of the paper can be stated as follows: 
Let M 7 (n;K) denote the subgraph of W(n;K) restricted to 
the nodes 1, . . . , |_7?\|. We first present scaling laws for the 
absence of isolated nodes in the form of a full zero-one law, 
and use these results to formulate conditions under which 
M.y(n;K) is a.a.s. not connected. Then, with < 71 < 72 < 
. . . < 7£ < 1, we give conditions on n, K and 71 so that 
HLy, (n; -K") is a.a.s. connected for each i = 1,2, ...,£; this 
corresponds to the case where the network is connected in 
each of the £ phases of the gradual deployment. As with 
the EG scheme, these scaling conditions can be helpful for 
dimensioning the pairwise key distribution in the case of 
gradual deployment. We also discuss the required number 
of keys to be kept in the memory module of each sensor 
to achieve secure connectivity at every step of the gradual 
deployment. Since sensor nodes are expected to have very 
limited memory, it is crucial for a key distribution scheme 
to have low memory requirements [0. In contrast with the 
EG scheme (and its variants), the key rings produced by the 
pairwise scheme of Chan et al. have variable size between 
K and K + (n — 1). Still, we show that the maximum key 
ring size is on the order logn with very high probability 
provided K = O(logn). Combining with the connectivity 
results, we conclude that the sensor network can maintain the 
a.a.s. connectivity through all phases of the deployment when 
the number of keys to be stored in each sensor's memory is 
O(logn); this is a key ring size comparable to that of the EG 
scheme (in realistic WSN scenarios HJ). 

These results show that the pairwise scheme can also be 
feasible when the network is deployed gradually over time. 
However, as with the results in JT6), the assumption of full 



visibility may yield a dimensioning of the pairwise scheme 
which is too optimistic. This is due to the fact that the 
unreliable nature of wireless links has not been incorporated in 
the model. However the results obtained in this paper already 
yield a number of interesting observations: The obtained zero- 
one laws differ significantly from the corresponding results in 
the single deployment case fl6l . Thus, the gradual deployment 
may have a significant impact on the dimensioning of the 
pairwise distribution algorithm. Yet, the required number of 
keys to achieve secure connectivity being O(logn), it is still 
feasible to use the pairwise scheme in the case of gradual 
deployment; the required key ring size in EG scheme is also 
O(log n) under full-visibility j4|- 

II. The model 

A. Implementing pairwise key distribution schemes 

The random pairwise key predistribution scheme of Chan et 
al. is parametrized by two positive integers n and K such that 
K < n. There are n nodes which are labelled i = l,...,n. 
with unique ids Idi, . . . , Id„. Write Af := {1, . . . n} and set 
Af-i := Af — {i} for each i = l,...,n. With node i we 
associate a subset r,,^ nodes selected at random from Af-i 
- We say that each of the nodes in T n ,i is paired to node i. 
Thus, for any subset A C Af-i, we require 

( (Vr 1 if \A\ = K 

[ otherwise. 

The selection of T n< i is done uniformly amongst all subsets of 
Af-i which are of size exactly K. The rvs r„.i, . . . , T n>n are 
assumed to be mutually independent so that 

n 

P [T n> i =Ai, i = 1, . . . , n] = J] P \Fn,i = M 

i=l 

for arbitrary Ai,..., A n subsets of Af-i, ■ . . ,Af- n , respec- 
tively. 

On the basis of this offline random pairing, we now construct 
the key rings E„ i, . . . , E„ n , one for each node, as follows: 
Assumed available is a collection of nK distinct cryptographic 
keys {u>i\i, i = 1, . . . ,n; I — 1, . . . , K} - These keys are 
drawn from a very large pool of keys; in practice the pool 
size is assumed to be much larger than nK, and can be safely 
taken to be infinite for the purpose of our discussion. 

Now, fix i = 1, . . . , n and let £ n> i : T n ,i —> {1, . . . , K} 
denote a labeling of T n ,i. For each node j in T n ,i paired to 
i, the cryptographic key Wi\e n is associated with j. For 
instance, if the random set T n ^ is realized as {ji, ■ ■ ■ , jx} 
with 1 < jx < ... < 2k < n, then an obvious labeling 
consists in £ n ,i(jk) = k for each k = 1, . . . , K with key u)^ 
associated with node ]\ . Of course other labeling are possible, 
e.g., according to decreasing labels or according to a random 
permutation. The pairwise key 

= [ Id il Id jk|<!n,i(j)] 

is constructed and inserted in the memory modules of both 
nodes i and j. Inherent to this construction is the fact that the 
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key uj* t y is assigned exclusively to the pair of nodes i and j, 
hence the terminology pairwise distribution scheme. The key 
ring E„.i of node i is the set 



Moreover, for any K > 2, we have 

P(n; K) > 1 - 



27 
2^2 



(4) 



{to* iv j G r nii } U {w* 4 , i G r„.j} (1) for all n = 2, 3, . . . sufficiently large. 



as we take into account the possibility that node i was paired to 
some other node j. As mentioned earlier, under full visibility, 
two node, say i and j, can establish a secure link if at least 
one of the events i G r„ j or j £ T n j is taking place. Note 
that both events can take place, in which case the memory 
modules of node i and j each contain the distinct keys 4 • 
and jj. It is also plain that by construction this scheme 
supports node-to-node authentication. 

B. Gradual deployment 

Initially n node identities were generated and the key rings 
£„,i, . . . , £„.„ were constructed as indicated above - Here n 
stands for the maximum possible network size and should be 
selected large enough. This key selection procedure does not 
require the physical presence of the sensor entities and can 
be implemented completely on the software level. We now 
describe how this offline pairwise key distribution scheme can 
support gradual network deployment in consecutive stages. In 
the initial phase of deployment, with < 71 < 1, let [71 n\ 
sensors be produced and given the labels 1, . . . , L7i n J- The 
key rings £„.i, . . . , S n i 7in j are then inserted into the memory 
modules of the sensors 1, . . . , |_7inJ, respectively. Imagine 
now that more sensors are needed, say [72". J — \_li n \ sensors 
with < 71 < 72 < 1. Then, [72 n\ — |_7i^J additional 
sensors would be produced, this second batch of sensors 
would be assigned labels [71 n\ + 1, . . . , [72^], and the key 



rings £ 



would be inserted into their 



memory modules. Once this is done, these [72"J — L7i n J new 
sensors are added to the network (which now comprises [72^J 
deployed sensors). This step may be repeated a number times: 
In fact, for some finite integer £, consider positive scalars 
< 71 < . . . < 7^ < 1 (with 70 = by convention). We 
can then deploy the sensor network in £ consecutive phases, 
with the k th phase adding L7fc"J — L7fc-i n J new n °des to the 
network for each k = 1, . . . ,£. 

III. Related work 

The pairwise distribution scheme naturally gives rise to the 
following class of random graphs: With n = 2,3,... and 
positive integer K with K < n, the distinct nodes i and j 
are said to be adjacent, written i ~ j, if and only if they have 
at least one key in common in their key rings, namely 



j iff £„,i n E n j 7^ 



(2) 



Let H(n; K) denote the undirected random graph on the vertex 
set {1, . . . , n} induced through the adjacency notion (0. With 
P(n; K) := P [H(n; K) is connected], we have shown |[T6l 
the following zero-one law. 

Theorem 3.1: With K a positive integer, it holds that 



lim P(n; K) = 



if K = 1 
ifK > 2. 



(3) 



IV. The results 

We now present the main results of the paper. We start with 
the results regarding the key ring sizes: Theorem 13.11 shows 
that very small values of K suffice for a.a.s. connectivity 
of the random graph M(n;K). The mere fact that M(n;K) 
becomes connected even with very small K values does not 
imply that the number of keys (i.e., the size |S n ^|) to achieve 
connectivity is necessarily small. This is because in contrast 
with the EG scheme and its variants, the pairwise scheme 
produces key rings of variable size between K and K+(n— 1). 
To explore this issue further we first obtain minimal conditions 
on a scaling K ; No — ^ No which ensure that the key ring of 
a node has size roughly of the order (of its mean) 2K n when 
n is large. 

Lemma 4.1: For any scaling K : No —> No, we have 

\Z n ,i(K n )\ P 



2K r , 



1 



(5) 



as soon as linin^oo K n = 00. 

Thus, when n is large |E„ i i(i , C n )| fluctuates from K n to 
K n + (n— 1) with a propensity to hover about 2K n under the 
conditions of Lemma 14.11 This result is sharpened with the 
help of a concentration result for the maximal key ring size 
under an appropriate class of scalings. We define the maximal 
key ring size by 



M n := I max |£ nji 

,i—l,...,n 



n = 2,3,. 



Theorem 4.2: Consider a scaling K : No — > No of the form 

K n ~ A log n (6) 

with A > 0. If A > A* := (2 log 2- ~ 2.6, then there 
exists c(A) in the interval (0, A) such that 



lim P [\M n {K n ) -2K n \> clogn] = 

n— too 

whenever c(A) < c < A. 

In the course of proving Theorem 14.21 we also show that 

F[\M n (K n ) - 2K n \ > clogn] < 2n~ h ^ 



(7) 



(8) 



for all n = 1, 2, . . . whenever 0(7) < c < 7 with ^(7; c) > 
specified in lfl6l . 

With the network deployed gradually over time as described 
in Section HU we are now interested in understanding how the 
parameter K needs to be scaled with large n to ensure that 
connectivity is maintained a.a.s. throughout gradual deploy- 
ment. Consider positive integers n = 2,3,... and K with 
K < n. With 7 in the interval (0, 1), let H 7 (n; K) denote the 
subgraph of H(n; K) restricted to the nodes {1, . . . , [7?iJ }. 
Given scalars < 71 < . . . < -ye < 1, we seek conditions 
on the parameters K and n such that H 7i (n; K) is a.a.s. 
connected for each i = 1,2, ...,£. 
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First we write P^tmK) 



f (n;K) is connected] 



P[C n , 7 (Jf)] with C nn (K) denoting the event that M 7 (n;K) 
is connected. The fact that M(n; K) is connected does not 
imply that W~(n;K) is necessarily connected. Indeed, with 
distinct nodes i,j = 1, ...,[771], the path that exists in 
M(n; K) between these nodes (as a result of the assumed 
connectivity of H(rt; K)) may comprise edges that are not 
in H 7 (n; K). The next result provides an analog of Theorem 



13.11 in this new setting. 

Theorem 4.3: With 7 in the unit interval (0, 1) and c > 0, 
consider a scaling K : N — >• N such that 

locrt 

K n ~c-2-. (9) 

7 

Then, we have lim, woo P 1 (n\ K n ) = 1 whenever c > 1. 

The random graphs H(n;if) and M 7 (n;K) have very dif- 
ferent neighborhood structures. Indeed, any node in H(n; K) 
has degree at least K, so that no node is isolated in 
M(n; K). However, there is a positive probability that iso- 
lated nodes exist in H 7 (n;/T). In fact, with P*(n;K n ) := 
P [H 7 (n; K) contains no isolated nodes], we have the follow- 
ing zero-one law. 

Theorem 4.4: With 7 in the unit interval (0, 1), consider a 
scaling K : No — > No such that © holds for some c > 0. 
Then, we have 



lim P*(n;K n ) 
where the threshold r( 7 ) is given by 
r( 7 ) := [ 



if c < r(j) 

1 if c > r( 7 ) 



log(l - 7) 



7 



(10) 



(11) 



It is easy to check that r(-f) is decreasing on the interval 
[0,1] with lim 7 _|_o r(-f) = i and lim 7 -|-ir( 7 ) = 0. Since a 
connected graph has no isolated nodes, Theorem 14.41 yields 
lim rwoo P [H 7 (n; K n ) is connected] = if the scaling K : 
No — > No satisfies (|9]l with c < r(j). The following corollary 
is now immediate from Theorem 14.31 

Corollary 4.5: With 7 in the unit interval (0, 1), consider a 
scaling K : No — > No such that © holds for some c > 0. Then, 
with r( 7 ) given by I771 ). we have 



lim P 7 (n; K n ) 



if c < r(j) 

1 ifc > 1 



(12) 



Corollary 14.51 does not provide a full zero-one law for the 
connectivity of H 7 (n;i^„) as there is a gap between the 
threshold r(-y) of the zero-law and the threshold 1 of the one- 
law. Yet, the gap between the thresholds of the zero-law and 
the one-law is quite small with ^ < 1 — r(-y) < 1. More 
importantly, Corollary |43] already implies (via a monotonicity 
argument) that it is necessary and sufficient to keep the 
parameter K n on the order of log n to ensure that the graph 
M 7 (n;K n ) is a.a.s. connected. It is worth pointing out that 
the simulation results in Section [V] suggest the existence of a 
full zero-one law for P 7 (n;K n ) with a threshold resembling 



r(j). This would not be surprising since in many known 
classes of random graphs, the absence of isolated nodes and 
graph connectivity are asymptotically equivalent properties, 
e.g., Erdos-Renyi graphs J2] and random key graphs ifPTl . 
among others. 

Finally we turn to gradual network deployment as discussed 
in Section [TT1 

Theorem 4.6: With < 71 < 72 < . . . < < 1, consider 
a scaling K : No — > No such that 

\ogn 



7i 



(13) 



for some c > 1 . Then we have 

lim P [C n , 71 (K n ) n . . . n C nni {K n )\ = 1. (14) 

n— >-oo 

The event [C 11 . n (K n ) n . . . fl C ll . n (K n )] corresponds to 
the network in each of its £ phases being connected as more 
nodes get added - In other words, on that event the sensors 
do form a connected network at each phase of deployment. 
As a result, we infer via Theorem 14.61 that the condition dT3~t 
(with c > 1) is enough to ensure that the network remains 
a.a.s. connected as more sensors are deployed over time. 

The main conclusions of the paper, obtained by combining 
Theorem 14.21 and Theorem 14.61 can now be summarized as 
follows: 

Corollary 4.7: With < 71 < 72 < . . . < "fe < 1, consider 
a scaling K : N -> N such that K n = 0(log n) with 



K n >max{( 7 i)- 1 ,A*} -logi 



2,3, 



Then, the following holds: 

1 ) The maximum number of keys kept in the memory mod- 
ule of each sensor will be a.a.s. less than 3K n ; 

2) The network deployed gradually in £ steps (as in Section 
ITU ) will be a.a.s. connected in each of the £ phases of 
deployment. 

V. Simulation study 

We now present experimental results in support of the 
theoretical findings. In each set of experiments, we fix n 
and 7. Then, we generate random graphs H 7 (n;if) for each 
K = 1 , . . . , K max where the maximal value A' max is selected 
large enough. In each case, we check whether the generated 
random graph has isolated nodes and is connected. We repeat 
the process 200 times for each pair of values 7 and K in 
order to estimate the probabilities of the events of interest. 
For various values of 7, Figure |l(a)| depicts the estimated 
probability P*(n; K) that H 7 (n; K) has no isolated nodes as 
a function of K. Here, n is taken to be 1,000. The plots 
in Figure |l(a)| clearly confirm the claims of Theorem 14.41 
In each case P*(n;K) exhibits a threshold behavior and the 
transitions from P*(n;K) = to P*(n;K) = 1 take place 
around K = r( 7 )i 2S ^ 1 as dictated by Theorem |4.4| the critical 
value K = r (7) -28-^ is shown by a vertical dashed line in each 
plot. 
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(b) 

Fig. 1. a) Probability that H 7 (n; if ) contains no isolated for n = 1000; in 
each case, the empirical probability value is obtained through 200 experiments. 
Verticai dashed lines stand for the critical thresholds asserted by Theorem \4.4\ 
It is clear that the theoretical findings are in perfect agreement with the practical 
observations, b) Probability that Mj(n;K) is connected for n = 1,000 
obtained in the same way. Clearly, the curves are almost indistinguishable from 
the corresponding ones of part (a); this supports the claim that absence of 
isolated nodes and connectivity are asymptotically equivalent properties. 

Similarly, Figure |l(b)| shows the estimated probability 
P-y(n; K) v.s. K for various values of 7 with n = 1000. For 
each specified 7, we see that the variation of P 7 (n; K) with K 
is almost indistinguishable from that of P*(n;K) supporting 
the claim that P y (n;K) exhibits a full zero-one law similar 
to that of Theorem 14.41 with a threshold behaving like r(j). 
We can also conclude by monotonicity that P 7 (n; K) = 1 
whenever (0 holds with c > 1; this verifies Theorem 14.31 
Furthermore, it is evident from Figure |l(b)| that for a given K 
and n, P~ ( (n; K) increases as 7 increases supporting Theorem 

EU 

We also present experimental results that validate Lemma 
14.11 and Theorem 14.21 For fixed values of n and K we have 




(b) 

Fig. 2. a) Key ring sizes observed in 1, 000 experiments for n = 200 and 
K = 4 — Only 2% of the key rings are larger than 3K and the largest key ring 
has size 20. b) Key ring sizes observed in 1, 000 experiments for n = 500 and 
K = 21 - Out of the 500, 000 key rings produced only 9 happened to be larger 
than 3K while the largest size observed is 67. 



constructed key rings according to the mechanism presented 
in Section Q]] For each pair of parameters n and K, the ex- 
periments have been repeated 1, 000 times yielding 1, 000 x n 
key rings for each parameter pair. The results are depicted in 
Figures 1-4 which show the key ring sizes according to their 
frequency of occurrence. The histograms in blue consider all 
of the produced 1, 000 x n key rings, while the histograms in 
white consider only the 1,000 maximal key ring sizes, i.e., 
only the largest key ring among n nodes in an experiment. 

It is immediate from Figures [2(a)|3(b)| that the key ring sizes 
tend to concentrate around IK, validating the claim of Lemma 
14.11 As would be expected, this concentration becomes more 
evident as n gets large. It is also clear that, in almost all cases 
the maximum size of a key ring (out of n nodes) is less than 
3K validating the claim of Theorem 14.21 
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(a) 




(b) 

Fig. 3. a) Key ring sizes obsewed in 1, 000 experiments for n = 1, 000 
and K = 24-1, 000, 000 key rings are produced. Only 5 of them happened 
to be larger than 3K and the largest observed key ring size is 75. b) Key ring 
sizes observed in 1, 000 experiments for n = 2, 000 and K = 26 - Out of the 
2000000 key rings produced only 2 happened to be larger than 3K the largest 
of them having 80 keys. 



VI. Conclusion 

In this paper, we consider the pairwise key distribution 
scheme of Chan et al. which was proposed to establish security 
in wireless sensor networks. This pairwise scheme has many 
advantages over other key distribution schemes but deemed not 
scalable due to i) large number of keys required to establish se- 
cure connectivity and ii) the difficulties in the implementation 
when sensors are required to be deployed in multiple stages. 
Here, we address this issue and propose an implementation 
of the pairwise scheme that supports the gradual deployment 
of sensor nodes in several consecutive phases. We show how 
should the scheme parameter be adjusted with the number n 
of sensors so that the secure connectivity can be maintained 
in the network throughout all stages of the deployment. We 
also explore the relation between the scheme parameter and 
the amount of memory that each sensor needs to spare for 



storing secure keys. By showing that the required number of 
keys is 0(logn,) to achieve connectivity at every step of the 
deployment, we confirm the scalability of the pairwise scheme 
in the context of WSNs. 



VII. A proof of Theorem I4.3I 

Fix 77 = 2,3,... and 7 in the interval (0, 1), and consider 
a positive integer K > 2. Throughout the discussion, 11 is 
sufficiently large so that the conditions 

2(K + 1) < 71, K + 1 < n - LttiJ and 2 < 771 (15) 

are all enforced; these conditions are made in order to avoid 
degenerate situations which have no bearing on the final result. 
There is no loss of generality in doing so as we eventually let 
n go to infinity. 

For any non-empty subset R contained in {1, . . . , Lt 77 -] 
we define the graph H 7 (n; K)(R) (with vertex set R) as the 
subgraph of H 7 (n; K) restricted to the nodes in R. We say that 
R is isolated in H 7 (n; K) if there are no edges (in H 7 (n; K)) 
between the nodes in R and the nodes in its complement 
i? c ' 7 := {1, . . . , [777] } — R. This is characterized by the event 
B nn (K;R) given by 



B n ,j(K; R) 



ieR, j G R ch 



Also, let C ntl (K; R) denote the event that the induced sub- 
graph H 7 (n; K)(R) is itself connected. Finally, we set 

A nn (K; R) := C n „(K-, R) R B n „(K; R). 

The discussion starts with the following basic observation: 
If H 7 (77; K) is not connected, then there must exist a non- 
empty subset R of nodes contained in {1, [7 n J}> sucn 
that H 7 (t7; K)(R) is itself connected while R is isolated in 



ly(n;K). This is captured by the inclusion 



(16) 



with A/"n l7 denoting the collection of all non-empty subsets of 
{1, . . . , L7"J}- This union need only be taken over all non- 
empty subsets R of {1,.. ., [jn\} with 1 < \R\ < [^\, 
and it is useful to note that [^-^-J = L^J- Then, a standard 
union bound argument immediately gives 



< 




[A nn (K;R)} 



A n ^{K;R)] (17) 



subsets of 



where A/" n , 7 , r denotes 



{1, . . . , Yin\ } with exactly r elements. 

For each r = 1, ...,\_jn\, when R = {l,...,r}, we 
simplify the notation by writing A n , 1:r (K) :~ A n ^{K]R), 
B nn . r {K) := B nil (K;R) and C n ' n ] r (K) := C r ^(K;R). 
For r = [7 n J' tne notation C nn ^ in \ (K) coincides with 
C nn (K) as defined earlier. Under the enforced assumptions, 
it is a simple matter to check by exchangeability that 

P [A n JK- R)} = P \A nn>r {K)] , R E Nn.^.r 



7 



and the expression < ,y _ L _ \_jn\ - r \ rK _ / _ r \*Ut»J-0 



iiGAf, r 



£ P[4, 1 (J(;fl)]=f 7 r ' lJ )p[i, 1 , r (A')] < (7ne) r _ e _(i^r) r ^ . e -(t)(L7»J-r)Jf 



follows since |^/^-y r | = (L7«h Substituting into (fTTT i we 



It is plain that 



.,7,r 

obtain the bounds 



\_iri\ 



V—\ 



[C„, 7 (*T] < E P (18) 



< 



r=l 



as we make use of the obvious inclusion A„ )7iT .(i^) C 

B n ,f,r(K). Under the enforced assumptions, we get as we no t e 



^ hne-e V " / (21) 



'[B n „, r {K)] (19) L7»J " r ^ L7»J - L^J ^ r = ^ ... f [!!_]. 

/ /„_|_ 7 „j +r _n\ r / / n _ r _n\ 1.7*1 -r n n 2 



if 7 \ I V if 



Next, consider a scaling K : Nn — > Nn such that d9| holds 
v if / / for some c > 1, and replace K by A'„ in d21l i according to 

To see why this last relation holds, recall that for the set this scalin 8- Usin 8 the form © of the scalin 8 we § et ' 

{1, r} to be isolated in H 7 (n; K) we need that (i) each of / W-l^ W 1 _ 2c /" ^"J-l^rJ 

the nodes r + 1, . . . , \^n\ are adjacent only to nodes outside a„ := 77ie • e V / = (-ye) ■ n V 7 " 

the set of nodes {1, rj; and (ii) none of the nodes 1, r „ , , _ . , ,. T . . , 

. , „ . , -, ii -., ■ , for each n = 1,2,..., with lim., _j.no c„ = c. It is a simple 

are adjacent with any of the nodes r + 1, . . . , 771 - This last , , ' 

. , 3 , , ■ , x- ■ , matter to check that 

requirement does not preclude adjacency with any of the nodes 

/ / I I I 

|/ynj + 1, ... ,71. Reporting ( fT9b into ( fT~8T >. we conclude that i- ( o r ( L7 n J ~ L~J 



lim 2cn ^— ^ = c, 

n-^oo y y 771 / / 

V\C n JK) c ] (20) 

, , , so that by virtue of the fact that c > 1, we have 

L ^ J /I l\ / (n-Yin\+r-l\\ r / (n-T-l\ \ LT™J ~ r 



r=l x 7 \ V if 



From (BTt we conclude that 



with conditions (fT5T l ensuring that the binomial coefficients are 
well defined. LVJ 00 

The remainder of the proof consists in bounding each of P [C„, 7 (A„) C ] < (a n ) r _■ ( a n) r = ^ 

the terms in (f2Qb . To do so we make use of several standard r=1 r=1 

bounds. First we recall the well-known bound where for n sufficiently large the summability of the 



l_7 n J\ f il n \ e \ T geometric series is guaranteed by (1221 . The conclusion 

J < ( J , r = 1,..., [jn\. lim IWOO P[C„ i7 (/<r) c ] = is now a straightforward conse- 

Next, for < K < x < y, we note that 

(if) _ TT ( x ^ \ < f —\ Fix n = 2, 3, ... and consider 7 in (0, 1) and positive integer 

(k) j} \y - £ ) ~ \V ) K such that K < n. We write 



quence of the last bound, again by virtue of 

VIII. A proof of Theorem|4.4 



decreases as £ increases from £ = 0to£ = K-l. Xn, 7 ,i( K ) : = 1 I Node i is isolated in H 7 (n; K)\ 

Now pick r = 1, . . . , l in \ . Under ___ we can apply these for each i = 1} ^^ L 7«J . The number of isolated nodes in 



since - 

y 



bounds to obtain H ^ n; jq is simply giyen by 

/I l\ / (n-hn\-tr-l\ \ r / (n-r-l\ \ Lt™J ~ r , 

/L7«J\ / ( if ) 1 ( \ k ) \ L J" J 



U M ("k 1 ) J ' I ("k 1 ) J w*) : = E 

rif 



i=l 

/ g \ (71 — O'T^ "t - 7* — 1 \ 

< ( - — — ) • ( — =— ■ ) whence the random graph H 7 (n; K) has no isolated nodes if 



' ^ n ^ I n ~ ( {K) = 0. The method of first moment [8] Eqn (3.10), p. 

n — r— 1\ K "-7"J r) ^^'^ ^ seconc i moment [8] Remark 3.1, p. 55] yield the useful 

n — 1 / bounds 



g 



The rvs Xn tl ,i(K), . . . , x„, 7 , |_ 7n J (A) being exchangeable, 
we find 



E[/„, 7 (A)] = L7™JE[x„, 7 ,i(A)] 



(24) 



and 



E[/„, 7 (A) 2 ] 

= L7«JE[xn, 7 ,iW] (25) 
+ hn\(l in \ - 1)E [Xn,7,lWXn,7,2(*0] 

by the binary nature of the rvs involved. It then follows in the 
usual manner that 



E[l„, 7 (A) 2 ] 
E[/n, 7 (^)] 2 



l_7n|E[Xn, T ,i(-fQ] 

L7«J -lE[x n , 7 ,l(%n, 7 ,2W 



(26) 



|_7nJ 



(E[ Xn , 74 (A')])^ 



From d23l and d24l we conclude that the one-law 

liiTLn^oo P [I nn (K n ) = 0] = 1 holds if we show that 



lim [ 7 n\E\xn,y,i(K n )} = 0. 



(27) 



On the other hand, it is plain from (l23~t and (l26l that the 
zero-law lim JWOO P [A li7 (A„) = 0] = will be established if 



and 



lim sup 



lim [jn\E [Xn,i(K n )} = oo 

i— >oo 

( E [Xn,~fA K n)Xn,~/,2{ K n)} 



< 1. 



(28) 



(29) 



The next two technical lemmas establish d27l . ( f28l ) and d29l 
under the appropriate conditions on the scaling A : N — >■ No- 

Lemma 8.1: Consider 7 in (0, 1) and a scaling if : No ^ 
No such that © holds for some c > 0. We have 

{0 if r(j) 
(30) 
00 it c < ryy) 

with r(j) specified via 1771) . 

Lemma 8.2: Consider 7 in (0, 1) and a scaling K : No — > 
No such that © hoJds for some c > 0. We have 



limsupf^^^^^f^Ul. 

™ 1 (E[Xn,7,l(^n)]) / " 



(31) 



Proofs of Lemma 18.11 and Lemma 18.21 can be found in 
Section I VIII-AI and Section IVIII-B1 respectively. To complete 
the proof of Theorem 14.41 pick a scaling A : No — > No 
such that (0 holds for some c > 0. Under the condition 
c > r(j) we get (|27| | from Lemma 18.11 and the one-law 
linin^oo P [I nn (K„) = 0] = 1 follows. Next, assume the 
condition c < r(j). We obtain (l28l l and d29l with the help 
of Lemmas 18.11 and 18.21 respectively, and the conclusion 
linin^oc P [A lj7 (A„) = 0] = is now immediate. 



A. A proof of Lemma \8.1\ 

Fix n = 2,3,... and 7 in (0, 1), and consider a positive 
integer A such that K < n. Here as well there is no loss of 
generality in assuming n — |_7 n J > K an d ll n \ > !■ Under 
the enforced assumptions, we get 



E[ x „, 7il (A)] 



rir J ) (( n K 2 Y 

(V) UV). 



[ 7 nJ - 1 



a(n; K) ■ I 1 — 



A 

n — 1 



L7»J-i 



(32) 



with 



a(n; if) 



(n-[7nj)! (n — 1 — A') ! 



(n-[jn\-K)\ (n-1)! ' 
Now pick a scaling A : No — >• No such that (O holds for 



some c > and replace K by A„ in (1321 with respect to this 
scaling. Applying Stirling's formula 



r- (m\ m 



to the factorials appearing in (1321 . we readily get 

a(n; K n ) — 



(n - [^n\)(n - 1 - K n ) 



Y (n- L7"J -A„)(n-1) 
~ a„/3„ (33) 

under the enforced assumptions on the scaling with 

(n - A„ - 



= 1- 



(n - l)"- 1 
A x "~ 1 



71 — 1 



(n - A„ - 1) 



and 

|8n 



(n- L7nJ) n "l-T"J 
(n - [7"J - A„)™-Lt"J- k " 

(ti- L7«J) 



1 - 



A„ 



(n - L7"-J - Kn) 



K„ 



n — |_7?iJ 

In obtaining the asymptotic behavior of (l33l we rely on the 
following technical fact: For any sequence m : No — > No with 
m n = 0(n), we have 



1 



-K„ 



(34) 



To see why d34l l holds, recall the elementary decomposition 

t 



log(l - a;) = —x - *(.t) with $(x) := 
valid for < x < 1. Using this fact, we get 



1 -t 



dt 



K 



. e -^m (35) 



for all n = 1,2,. 
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Under the enforced assumptions we have m n = 0(n) and 
K n = O(logn), so that 



lim — — = and lim m n ( — — ) = 0. 

n-yoo rriri ri->oo \ TfTln 



It is now plain that 



lim m„tf [ — 1=0 

n-too \ 777, 



as we note that lim x j,o -^r^ = \- This establishes d34b via 
03). 

Using fl34l ), first with m„ = n— 1, then with m n = n— {jyn}, 
we obtain 

n-l 



1 



n - 1 



-K n 



and 



whence 



A„ 



ft — ['yn] 



-(«- Lt»J) 



(e-*») 



n - [7 n J - 



n — K n - 1 

With the help of ( f32t and ( 1331 we now conclude that 



(36) 



nE]Xn,i,i(K n )] (37) 
A„ \ L7nJ - X (n-^nl-K^ 



n 1 



n — 1 J \ n — K n — 1 

A final application of (iMt . this time with m n = n— 1, gives 

L7«J-i 



1 



gn 

n-l 



1 



A» 
n-l 



L-rrc]-i 
n— 1\ n-i 



(38) 



since lim n _>oo 1 = 7- Reporting (f38T > into ( f37T > we obtain 

nE[x„, 7l i(Jf»)] ~e«» (39) 

with 

C„ ■= log n - ( i — J —r- + log ( ^ — ) ) K n 



V n-l 



n - K„ - 1 



for all n = 1,2,.... Finally, from the condition (0 on the 
scaling, we see that 

,. Cn 1 . log(l - 7) , c 
lim ; = 1 — c + c = 1 



n— >oo loa" n 



7 



r(7) 



Thus, lim„^oo Cn = — oo (resp. oo) if r(^) > c (resp. r(7) < 
c) and the desired result follows upon using 



B. A proof of Lemma \8.2\ 

Fix positive integers n = 3, 4, . . . and K with K < n. With 
7 in (0, 1), we again assume that n— \jn\ > A and [777 J > 1. 
It is a simple matter to check that 

/>-L7»J\\ 2 />-3\\ L7 " J " 2 



K 



n—l\ 
K ) 



and invoking (DZb we readily conclude that 

E[Xn, 7 ,l(-K")Xn, 7 ,2(lQ] 

(E[ Xn , 7il (A)]) 2 

/ /»-3\ \ L7«J"2 / \ a(LTnJ-l) 



K 



A" 



(V) 



?i - 1 - K \ In — 2 — A 



n-l 

n — 1 
n — 1 — K 



n - 2 

2(L7«J-1) 



L7»J-2 



n-2- A 
n- 2 



L7«J-2 



1 



A 



n-2 



L7«J-2 



1 



n- 1 
n-l- K 

A 



[ 7 nJ 



n — 1 — K 



L 7 nJ 



< e -K-E{n;K) 

where we have set 

E(n;K) := 

?7 — 2 n—l — K 

Elementary calculations show that 

\~fn\ A(A - 1) 2 A 



(40) 



L777J - 2 |_7™J 



-K ■ E(n; A) 



77 - 2 77 - 1 — A 77-2 



Now pick a scaling A' : No — > No such that (0 holds for 
some c > 0. It is plain that lim, woo K n E(n; K n ) = and 
the conclusion (fJTJ follows from ( f40b - 

IX. A proof of Theorem|4.6I 



Pick < 71 < 72 < . . . < 7£ < 1 and consider a scaling 
A : N ->• N such that 



A„ ~ c 



log 77 
7i 



for some c > 1. It is plain that (TPfl i will hold provided 

lim P[C„, 7fc (A„)] = l, fc = l,...,l (41) 

n— J-oo 

For each k = 1,2, . . . ,£, we note that 

log 77 log 77 7 fe 
c = Cfc with Cfe := c — 

7i 7fe 7i 

for all 77 = 1,2,.. .. But c > 1 implies Cfc > 1 since 71 < 
. . . < 7£. As a result, H 7fc (77; K n ) will be a.a.s. connected by 
virtue of Theorem 14. 3 1 applied to H 7fc (77; A), and ( |4TT > indeed 
holds. 
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X. A proof of Lemma |4~T1 

Fix n = 2,3,... and positive integer K with K < n. For 
each i = 1, 2, . . . , n, node i is assigned a key ring E„ A whose 
size is given by 



XI. A proof of Theorem |4.2| 

Fix the positive integers n = 2, 3, . . . and A with K < n. 
Using d43t we readily get 



max |S rl .i| — 2K = max (B n ^ — K) 

i—l.....n ' / i—l,....n 



= |r nii | + ^2 l [i e r nj - 



(42) Therefore, with any given t > 0, we find 



This is a simple consequence of the definition (Q~|i. We also 
define the maximal key ring size as 

M„ := max i= i,... j „|S„, i |. 

It is easy to see that 

lEn.il =K + B nA (43) 

where B n ^ is the rv determined through 

n 

B n ,i ■■= 2J 1 e r ">j] • 

Under the enforced independence assumptions, the rv B n) , is 
a binomial rv Bin(n — 1, r?rr)> with 



max |E„ ti | ) - 2A" 

1=1,. . . ,n 



max (B U: i — K 

i— 1, n 



> i 
> t 



max i? n ,i > K + £ 

z— l....,n 



B„ <K-t 



(46) 



We take each term in turn. First a simple union argument 
shows that 

P[max 1=1 .... j „B„. ! > K + t] 
= P[U? =1 [fl nii >K + t}} 



i=l 



and 



E [B n>i ] = (n-l) 



Vax[B n>i ] = (n - 1) 



A" 



nP[B n ,! > A + t] 



(47) 



= A 



n - 1 
A n - 1 - K 



n — 1 7i — 1 
As a result, E [|E„ fi |] = 2A and 

A 



n — 1 



It is now plain that 

E n j 



E 



E[|E„,i 



Var[|S n ,«|] 
E[|E„,|] 2 
1 ( 1 



4 V K n—l 



so that 



E 



2A 



1 



1/1 



4 V K n-l 



(44) 



(45) 



since the rvs B n ^,...,B nn are identically distributed (but 
not independent). Next we note that 

P [max i= i i ... i „B„ ii < K - t] 

= P[B n4 <K-t, i= l,...n) 

< mia i= i > ... >n P [B n>i < K - t] 

= P[B nA <K n -t). (48) 

To proceed we recall standard bounds for the tails of 
binomial rvs J9] lemma 1.1, p. 16]: With 

H(t) := 1-t + tlogt, 

we have the concentration inequalities 

P [B nA > A + t}< e-^'- 9 "^) 

and 



Under the enforced assumptions, we have 

2" 



lim E 

n— too 



|E„,!(A„) 



2A„ 



1 



P [B n>1 < K -t}< e - K - H{ ^ ) 

where the additional condition < t < A is required for 
the second inequality to hold. Simple calculations on the 
appropriate ranges show that 

(K±t\ , . ft 

-K-Hl-^j =±t-(K±t)-\og\l±- 

Thus, by the first concentration inequality, we conclude 
from (07} that 



i=i »B B ,i > K + t] < e A ^ K ' t} 



(49) 



by the earlier calculations (|43T >. and the desired result (|5} 
follows. ■ 



with 



A n (K; t) :=\ogn + t- (A + t) ■ log ( 1 + — 



II 



The second concentration inequality and d48l > together yield 

P max, : „/.',,, <K-t}< e B "(^*) (50) 

with 

B n (K; t) := -t - (K - t) ■ log (l - 1 

under the additional constraint < t < K . 

Now consider a scaling K : No — > No of the form (|6) for 
some 7 > 0, and select the sequence t : No — > K+ given by 

t n = clogn, n = 1,2,... 

with c in the interval (0,7) (so that < t n < K n for all n 
sufficiently large). 

Under appropriate conditions on 7 and c, we shall show that 



lim A n (K n ;t n ) = -00 



and 



lim B n (K n ;t„) = -00. 
n— >oo 

The convergence statements 

lim P[maxi=i n B n i(if n ) > K n +t n ] = 



(51) 
(52) 



and 



lim P[max i= i > ... t „S Tl> i(iif n ) < K„ - t„] = 



then follow from ( f49T > and (150) . respectively, and the desired 
conclusion (|7) flows from (06). 

With the selections made above, we get A n (K n ;t n ) ~ 
0(7; c) logn and B n (K n ; t n ) ~ 6(7; c) logn with coefficients 
0(7; c) and 6(7; c) given by 



0(7; c) := 1 + c - (7 + c) • log ( 1 + - ] , c> 



and 



6(7; c) := — c— (7 — c) ■ log |^1 J , < c < 7. 

Thus, in order to ensure (IBTt and (152) . we need to find c 
in the interval (0,7) such that 0(7; c) < and 6(7; c) < 0, 
respectively. To that end, we first note that 

da , 



and 



dc (r,c) = -\og[i + -) <o, 00 



36 f c\ 

— (7; c) = log I 1 - - 1 <0, 0<c< 7 . 

Therefore, both mappings c — s- 0(7; c) and c —J- 6(7; c) are 
strictly decreasing on the intervals (0,oo) and (0,7), respec- 
tively. Since lim c j,o 6(7; c) = 0, it is plain that 6(7; c) < on 
the entire interval (0,7). On the other hand, it is easy to check 
that lim c ^o 0(7; c) = 1 and 

lim 0(7; c) = 1 -7(21og2- 1) = 1- — . 

c|7 7* 



Hence, if we select 7 > 7*, then 0(7; c) < for all c > 0(7) 
where c(j) is the unique solution to the equation 



0(7; c) 



0, c>0. 



(53) 



Uniqueness is a consequence of the strict monotonicity men- 
tioned earlier. 

The proof will be completed by showing that the constraint 



0(7) < 7, 7 > 7* 

indeed holds. For each 7 > 0, define the quantity ^(7) := 
In view of d53l it is the unique solution to the equation 



(54) 

c( 7 ) 



-+x-(l + x) log (l + x) = 0, x > 0. (55) 

7 



This equation is equivalent to 



1 



(56) 



— = tp(x), x > 
7 

where the mapping <p : M + — > R + is given by 

(f(x) = (1 + x) log (1 + x) — x, x > 0. 

This mapping ip : R + — > M. + is strictly monotone increasing 
with lim^o f{ x ) = and lim^-j-oo 93(21) = 00, so that ip is 
a bijection from R + onto itself. It then follows from ( |56) 
that 2(7) is strictly decreasing as 7 increases. Since (p(l) = 
(7*)~ , we get x(7*) = 1 by uniqueness, whence ^(7) < 
x(j*) = 1 for 7 > 7*, a statement equivalent to ( 154) . 
Careful inspection of the proof shows that (|8) holds with 



M7; c ) : = - max ( a (7; c), 6(7; c)) 



(57) 



on the range 0(7) < c < 7, and it is clear from the discussion 
above that ft, (7; c) > when 7 > 7*. ■ 
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